Cyber Risk Management and Assurance Advisor

Government Digital & Data; Manchester; On-site; GBP 50,000 - 70,000; Full time

Job summary

A government department for digital services is seeking an experienced cybersecurity professional to lead risk management and assurance efforts. The role involves delivering critical security assessments and mentoring teams on best practices. Ideal candidates will have a Master's degree and relevant certifications, with strong communication skills and experience in complex environments.

Benefits

Learning and development opportunities

Collaboration with skilled professionals

Qualifications

• Experience in delivering high-quality cybersecurity risk assessments in complex environments.
• In-depth understanding of cyber risk management and IT Health Checks.
• Proficient in regulatory frameworks and secure design principles.

Responsibilities

• Lead cybersecurity risk management and assurance for major applications.
• Deliver critical security assessments and ensure compliance with security principles.
• Mentor and train digital service teams on best practices and risk management.

Skills

Cybersecurity risk assessments

Threat modeling

Security architecture

Regulatory compliance

Communication skills

Education

Master’s Degree in relevant discipline

Relevant industry qualifications (e.g., CISSP)

Job description

Responsibilities

• lead cyber and information security risk management, assurance, and architectural advisory for major applications and digital services during alpha, beta, and early live phases
• deliver critical security assessments and IT Health Checks, providing expert assurance across portfolio projects, with a focus on SaaS tooling compliance against NCSC Cloud Security Principles
• facilitate and oversee Security Working Groups throughout all key development and deployment stages, ensuring risks are tracked, logged, and reported to the Head of Cyber Risk and Assurance, with actionable recommendations provided
• produce formal risk assessments and risk treatment plans (RTPs) for all digital services and associated tooling, ensuring robust protection in accordance with business risk appetite
• develop, review, and advise on Secure by Design policies/practices, including safe use of AI, secure coding, and regulatory compliance frameworks (e.g., OWASP, DPIA, GovAssure)
• coordinate cross-platform activities and enable secure delivery of new GDS services, including supporting incident management and continuous improvement of live service security practices
• routinely provide monthly (and ad-hoc) risk briefings to senior leaders, evidencing assurance, identifying risks outside tolerance, mapping exposure, and recommending mitigations and controls
• mentor and train digital service teams and wider Information Security staff, sharing best practices and building internal capability for risk assessment and management
• support implementation and ongoing usage of risk management tooling, ensuring all details are uploaded promptly and appropriately, such as the SureCloud risk register
• engage proactively with senior internal and external stakeholders, promoting security culture and enabling confident delivery aligned with organisational priorities
• future line management activities as the team grows

Qualifications

• demonstrable experience delivering high-quality, detailed cyber security risk assessments and assurance in large, fast moving, complex digital environments, ideally government or critical infrastructure
• in-depth understanding of cyber risk management, threat modelling, security architectural advice, and formal IT Health Checks, including experience with SaaS environments and cloud security principles
• experience interpreting and applying relevant cyber security standards, regulatory frameworks, and secure by design principles within a multi-disciplinary digital team
• a self-starter, using your considerable experience and skills to work independently and with confidence
• track record of building cross-functional relationships and leading multi-platform security initiatives, with the ability to brief, influence, and advise senior stakeholders
• strong written, verbal, and interpersonal communication skills, able to distil complex findings into actionable recommendations for non-technical and executive audiences
• evidence of personal commitment to continuous learning and sharing of best practices, with experience mentoring, coaching, or enabling capability-building in others
• ability to assess the implications and risks of emerging technologies (such as AI, SaaS, cloud services) and proactively recommend security interventions
• knowledge of Civil Service values: respect, collaboration, inclusivity, and commitment to public service, with a strong focus on organisational culture, relevant industry qualifications and accreditations e.g. CISSP or hold a Master’s Degree in a relevant discipline.

About the role

The Government Digital Service (GDS) is the digital centre of government. We are responsible for setting, leading and delivering the vision for a modern digital government. We are part of the Department for Science, Innovation and Technology (DSIT) and employ more than 1,000 people all over the UK, with hubs in Manchester, London and Bristol. The Information Security team at GDS protects the people, services and information used to deliver critical government digital infrastructure such as One Login. We do this by supporting a secure software development lifecycle, setting and checking proportional organisation policies and building a positive, no-blame security culture across the organisation.

The Government Digital Service is where talent translates into impact. From your first day, you'll be working with some of the world's most highly-skilled digital professionals, all contributing their knowledge to make change on a national scale. Join us for rewarding work that makes a difference across the UK. You'll solve some of the nation's highest-priority digital challenges, helping millions of people access services they need.

The Government Digital Service (GDS) is the digital centre of government. We are responsible for setting, leading and delivering the vision for a modern digital government. Our priorities are to drive a modern digital government, by: 1. joining up public sector services 2. harnessing the power of AI for the public good 3. strengthening and extending our digital and data public infrastructure 4. elevating leadership and investing in talent 5. funding for outcomes and procuring for growth and innovation 6. committing to transparency and driving accountability. We are home to the Incubator for Artificial Intelligence, the world-leading and at the forefront of coordinating the UK's geospatial strategy and activity.

We lead the Government Digital and Data function and champion the work of digital teams across government. We are part of the Department for Science, Innovation and Technology (DSIT) and employ more than 1,000 people all over the UK, with hubs in Manchester, London and Bristol. The Information Security team at GDS protects the people, services and information used to deliver critical government digital infrastructure such as One Login. We do this by supporting a secure software development lifecycle, setting and checking proportional organisation policies and building a positive, no-blame security culture across the organisation.

The Government Digital & Data London, England, United Kingdom > 1000 employees Corporate / Direct Employer Government Digital and Data is a community of experts leading digital transformation in government, creating more efficient services that have a meaningful impact on people's lives. Government Digital and Data professionals benefit from cross-government events and learning. From webinars from the world's leading innovators to digital upskilling sessions. They enhance our professionals' skills and capabilities, which ultimately enables them to be a part of the world-leading advancements in digital transformation and government innovation.